Overview
We are given a raw disk image that contains multiple partitions, one of which is a LUKS encrypted container. We must locate the password outside the filesystem to decrypt and mount the partition.
Reconnaissance
Extracting the zip archive yields quest.img.
$ fdisk -l quest.img
$ file quest.imgThe file commands identify a LUKS encrypted container. The description hints at finding the key in the "space between sectors" or the "void".
Exploitation Strategy
Instead of attempting to crack the container, we inspect the raw disk trailing space or slack sectors.
Running a script to print the end of the disk image reveals the key:
$ tail -c 2048 quest.img
# Output string found: Th1ngs_fr0m_de3p_in_t1me_1983We open the LUKS container with the discovered password and mount the device.
Solution Code
# 1. Unlock LUKS container
# cryptsetup luksOpen quest.img vault
# Enter password: Th1ngs_fr0m_de3p_in_t1me_1983
#
# 2. Mount filesystem
# mount /dev/mapper/vault /mnt
# Read /mnt/flag.txtFlag
CrackOn{Th1ngs_fr0m_de3p_in_t1me_1983}